﻿#ifndef PROCESSMODULE_H
#define PROCESSMODULE_H

#include <typesdef.h>
#include <fileservice.h>
#include <systemservice.h>
#include <disassembleservice.h>
class ProcessService
{

public:
    ProcessService();
    //获取进程列表
    bool CreateProcessListSnapshot(QList<ProcessBean>* qProcessList);
    //内核路径转换为应用层路径
    BOOL DosPathToNtPath(LPTSTR pszDosPath, LPTSTR pszNtPath);
    //获取进程路径
    BOOL GetProcessFullPath(DWORD dwPID, TCHAR pszFullPath[MAX_PATH]);
    //获取文件图标
    QPixmap  GetFileIcon(QString path);
    //遍历完整用户态内存枚举进程模块列表
    bool EnumProcessModules(DWORD dwPID,QList<ProcessModuleBean>*qProcessModuleList);
    //获取进程模块列表
    bool CreateProcessModuleListSnapshot(DWORD dwPID,QList<ProcessModuleBean>*qProcessModuleList);
    //获取进程线程列表
    bool GetProcessThreadList(DWORD dwPID,QList<ProcessThreadBean>*qProcessThreadList);
    //获取线程状态信息
    bool GetThreadStatusInfo(ULONG dwPId,ULONG dwTId,PSYSTEM_THREAD_INFORMATION psti);
    //获取线程状态字符串
    QString GetThreadStateString(THREAD_STATE threadStatus, KWAIT_REASON waitReason);
    //获取进程令牌权限
    BOOL EnableDebugPrivilege();
    //恢复进程
    ULONG NtResumeProcessImpl(HANDLE hProcess);
    //挂起进程
    ULONG NtSuspendProcessImpl(HANDLE hProcess);
    //结束进程
    bool NtTerminateProcessImpl(ULONG dwPId,UINT uExitCode);
    //结束线程
    NTSTATUS NtTerminateThreadImpl(ULONG threadId,UINT dwExitCode);

    bool GetSpecifiedModuleInformation(ULONG dwPId, PProcessModuleBean module);

    //注入DLL文件到指定的进程空间
    bool InjectDllToProcess(ULONG dwPId,QString szExePath);


private:
    //返回进程列表
    QList<ProcessBean> qList;


    NtQueryVirtualMemoryDef NtQueryVirtualMemory;
    //查询线程详细信息teb,线程起始地址
    NtQueryInformationThreadDef NtQueryInformationThread;
    //查询进程列表以及线程详细信息(状态)
    NtQuerySystemInformationDef NtQuerySystemInformation;
    //恢复进程
    NtResumeProcessDef NtResumeProcess;
    //挂起进程
    NtSuspendProcessDef NtSuspendProcess;

    FileService fileService;

    SystemService systemService;

    DisassembleService disassembleService;

    IsWow64ProcessDef IsWow64Process;

    DllMainCRTStartupDef DllMainCRTStartup;
};

#endif // PROCESSMODULE_H
